Security
.
Netsky send itself to the email addresses it finds when scanning hard drives and mapped drives of infected systems. A TechRepublic return email address doesn't necessarily mean it came from TR, but rather someone who had that particular email address in an address book.
I've been fending these off for a couple of days, and I just came from a meeting where I brought it to the attention of many in our office. We're even getting them from our very own email addresses, even though that email address didn't send it.
This is a sneaky little sucker.
by cactus pete
How is TR set up that my email address [it only exists for them, and only within their database, for what I know] can be accessed from someone's address book?
Didn't TR have a little hacking competition where they explained how the database is supposed to be separate from public domain accessible computers, etc?
.
That's interesting.
So either the virus came from TechRepublic.
OR
Someone hacked into TechRepublic server using it as a launching pad for their virus.
OR
TechRepublic provided your email address to a third party.
by cactus pete
by boxwood
THE ONE COMMENT THATS STAND OUT IS THAT A COOKIE WAS FOUND THAT TRANSMITS DATA TO SOMEWHERE-PERHAPS YOU TECHS WITH MORE KNOWLEDGE THAN I HAVE CAN SEARCH THROUGH THAT COOKIE.
OUR INFO IS GOING OUT TO A THIRD PARTY, AS I PREVIOUSLY MENTIONED IN THAT DIDCUSSION.
.
Your take will be quite helpful.
.
Of course, that should be chime in.
I hate it when I err.
by mysuitelife2
TechRepublic doesn't store user email addresses unencrypted in any cookie. Only the site that created the cookie can read the cookie. So TechRepublic's cookies are not the culprit.
We recommend you contact the ISP for your email account, as they are more likely where the security breakdown is. Also, contact ParadigmLearning.com and ask them how they got your e-mail address.
Hope this helps.
by boxwood
by cactus pete
Well, I am my ISP, so there was no security breakdown there.
But I'll check with those uncovered by Lordinfidel.
by lordinfidel
Has anyone ever contacted you thru the Peer area.
If so, that is more likely the culprit.
The only way to determine where the e-mail originated is to look at the headers.
You can always tell what mail servers it traveled thru (via IP not name) and the originating clients IP, (assuming both the server IP and the client IP were not spoofed, which is not typical of viruses, spam yes, viruses no).
Post the full headers of the e-mail and i/we can tell where it came from.
by cactus pete
Well, no one has [to my knowledge] attempted to contact me that way. The one time I sent someone else a message through it, I have changed my alias' address, so I don't think that's the case.
But of course, I was typing faster than thinking, and it's likely that the email address I posted is actually someone else [perhaps another TR member] who is just in the infected machine's address book.
Here is a censored portion of the header in question:
Received: from aol.com ([65.243.99.194]) by xxxxxxxx.xxxxxx.com (
8.12.10/8.12.10/SuSE Linux 0.7) with ESMTP id i1OEsOls028680 for
; Tue, 24 Feb 2004 08:54:27 -0600
Message-ID: <200402241454.i1OEsOls028680@xxxxxxxx.xxxxxx.com>
From: bulldog6111960@aol.com
To: xxxxxxxxxxxx@xxxxxx.com
Subject: bug
Date: Tue, 24 Feb 2004 09:49:24 -0500
MIME-Version: 1.0
X-Priority: 3
X-MSMail-Priority: Normal
X-WSS-ID: 6C25BBF2687100-01-04
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_0003_207F9736.3D45ABC3"
X-OriginalArrivalTime: 24 Feb 2004 14:49:34.0546 (UTC) FILETIME=[6AF5E320:01C3FAE5]
It's one of my personal servers, so I xed out a little.
The IP doesn't respond to anything I had time to test, and it's owned by UUNet... That's as far as I bothered to go.
by lordinfidel
65.243.99.194 is defintetly not a mail server, or if it is it's not a incoming mail server.
all because we can't ping it just means that icmp is probably disabled.
But we can get to it's IP before it, 65.243.99.193 which is probably part of the same netblock, like a /29 or /30.
there is no rdns entries for either of those IP's,
.193 or .194......
But going up one more IP to .195 and we get
C:\winnt\system32>nslookup 65.243.99.195
Name: mail.paradigmlearning.com
Address: 65.243.99.195
Aliases: 195.99.243.65.in-addr.arpa
So another trace to that machine to see if it is on the same network as .194 and voila'
14 30 ms 30 ms 30 ms 65.243.99.193
It is going to that same netblock. So we can now assume that it is part of the paradigmlearning.com
from this point a quick NS lookup to see what kind of juicy info we can pull up
paradigmlearning.com nameserver = magellan.datag.com
paradigmlearning.com nameserver = util.datag.com
paradigmlearning.com nameserver = desoto.datag.com
util.datag.com internet address = 66.230.222.160
desoto.datag.com internet address = 24.73.102.50
magellan.datag.com internet address = 24.73.102.40
So we can probably see that they do not have a dedicated IT staff.
by lordinfidel
A quick whois reveals:
Paradigm Learning (PARADIGMLEARNING-DOM)
2701 N Rocky Pt Dr #400
Tampa, FL 33607
US
Domain Name: PARADIGMLEARNING.COM
Administrative Contact:
Paradigm Learning (27144837O) dianab@PARADIGMLEARNING.COM
2701 N Rocky Pt Dr #400
Tampa, FL 33607
US
(813) 287-9330 fax: 999 999 9999
Technical Contact:
DataGlyphics Hostmaster (HD777-ORG) hostmaster@DATAG.COM
449 CENTRAL AVE STE 201
ST PETERSBURG, FL 33701-3877
US
727.827.3939 fax: 727.827.3940
Record expires on 22-Oct-2008.
Record created on 23-Oct-1997.
Database last updated on 24-Feb-2004 17:46:50 EST.
Domain servers in listed order:
MAGELLAN.DATAG.COM 24.73.102.40
DESOTO.DATAG.COM 24.73.102.50
UTIL.DATAG.COM 66.230.222.160
-------------------
Which corresponds to our initial trace that paradigm is in florida:
13 20 ms 30 ms 30 ms 195.ATM7-0.GW1.TPA2.ALTER.NET [152.63.81.185]
(tpa2 is the Tampa NAP)
So we now know that they do not have a dedicated IT staff since their admin contact is a actual name (big no no in the IT world). Their domains are hosted by another company.
And for the coup de cra (let's head over to their website) which is at 24.73.102.138, same network as DATAG.com.
After some info, they outsource most of their IT work, from
http://www.datag.com/dg.lts/id.83/press.view_press_release.htm
About DataGlyphics, Inc.
Established in 1998, St. Petersburg-based DataGlyphics develops, hosts and manages Internet applications. Services include strategic consulting, Intranet and Extranet development, application integration, custom software application development, creative direction, hosting, and managed services. Clients include: Nokia Mobile Phones, Trend Magazines, Teltronics, Florida Marine Research Institute, IBHS, SDII Global, The Poynter Insitute, Pinellas County Economic Development, RedVector.com, Lazzara Yachts, and St. Petersburg-Clearwater International Airport.
So I would just send dianb an e-mail letting her know that I host on her network is infected.
If .194 is not a outgoing mail server, but indeed a host on their network (aka nat or proxy device) it is severely misconfigured if it is allowing a host to generate it's own smtp messages.
by cactus pete
I cut most of the downstream stuff, as that alias is forwarded to my work account.
But nice job scanning things. Wish I had time to do that today... [along with all the virus activity today, the damned building caught on fire.]
by joseph moore
So, I turned on Filemon from Sysinternals, and had it filter to just display any TXT files that were touched. I then opened up IE, and came to the site, and bounced around. I wanted to see what cookie files Techrepublic.com.com opened up.
When I first came to TR, the COM cookie opened. For me, it was JOE@com[1].txt that was used; it also used a temp cookie, JOE@com[2].txt, and then deleted it. There's quite a bit of stuff in this cookie, but nothing that is easily readable or makes any sense. A few references to the com.com domain, but that's it. Ok.
On the NetAdmin page, I got a hit for the ZDNET cookie (JOE@zdnet[1].txt), which also used a temp cookie for a short time (JOE@zdnet[2].txt). In this cookie, there is less stuff then the COM cookie, and none of it can be easily read for anything useful. (there is a piece of text that looked like an interesting FQDN, but I don't think it is really one; just a coincidence).
Lastly, on the new home page, I tried the Linux survey at the bottom of the page. When you Submit your vote, a cookie for POLLS is made (JOE@polls[1].txt). Now, in this cookie there is a reference to:
polls.cnet.com/polls
And if you go to http://polls.cnet.com you get a "page not found" error on a Cnet web server.
So, what does all of this mean? Well, maybe the cookie info used here at TR is shared by the ZDNET cookie, and maybe even passed to Cnet in some way (through the Polls cookie at least). CNET does own TR and ZDNET (or is it ZDNET that ownes CNET? I forget right now), so it is probably safe to assume that the TR user database would be available to CNET/ZDNET also.
Therefore, who knows where the leak could have occurred?
by lordinfidel
from ParadigmLearning that you may have contacted?
Or may have contacted you?
Your alias may of have appeared on a cc list that someone on their nework was on.
If your still getting them, I would shoot over a friendly e-mail to dianab@paradigmlearning.com.
Make sure to Include the headers of the e-mail's.
I post a sample letter that I use.
by lordinfidel
Suject: Excessive E-mail containing the Netsky Virus
(make sure this is signed with PGP and sent
from an official alias mailbox like, NetSec or NetOps@company name)
Please be advised that a host on your network
is infected with thethe MyDoor virus.
Although the virus did not enter my network and was stopped at my
mail gateway, it is flooding my mailbox with e-mail.
As I am sure your well aware, administrators usually receive high
volumes of e-mail and this extra amount is quite frustrating.
For your viewing pleasure, I have enclosed the headers of several of
the infected e-mails. While the source e-mail address is spoofed, you
can plainly see, they are originating from the same host within your network.
Please take the appropriate steps in helping your user overcome
their misfortune or ignorance, which ever the case my be.
While I am sure that you will take the responsible measures, failure
to act will force me to treat these e-mails as intentionally hostile
and will contact your ISP and the appropriate law enforcement agencies.
Thank you in advance for your cooperation in this matter.
your name
company
title
e-mail
tel #
<----E-mail headers--->
by cactus pete
by cactus pete
Unfortunately, she couldn't confirm that 194 was one of her IPs. I'm about to see if AlterNet would be willing to tell me who it was.
Again, I set up an alias to point to me and entered that to TR's site for them to send me those newsletters. I don't recall anyone sending me an actual conversive message to that address. If they had, they still wouldn't know it, as TR masks that for our privacy, right?
And when replying, that's not even one of my From field choices.
Hence, my worry. [For any rep from TR, I'm not trying to blame anyone, I'm trying to solve an issue that has potential dumb solutions or scary ones, equally likely.]
I'll keep everyone posted.
by lordinfidel
She obviuously has no idea what she's doing then.
Unless they have some sort of shared space where the IP just before their mailserver and between their router belongs to someone else. Which I personally think is highly unlikely.
I can't even see how a subnet could be broken up into that. Because A /30 would break down to
IP Mask Notes ...
65.243.99.192 255.255.255.252 Subnet Address
65.243.99.193 255.255.255.252
65.243.99.194 255.255.255.252
65.243.99.195 255.255.255.252 Broadcast Address
And since .195 was their e-mail server address, I doubt highly that they have a /30, more likely a /29
A /29 breaks down to
IP Address : 65.243.99.194
Address Class : Classless /29
Network Address : 65.243.99.192
Subnet Address : 65.243.99.192
Subnet Mask : 255.255.255.248
Host Range:
65.243.99.193 to 65.243.99.198
Broadcast : 65.243.99.199
The /29 is the only one that makes sense since it state that .193, .194 and .195 are on the same network. From our trace we can clearly see that .193 is some sort of netwk device (rtr or fwl).
That and the fact that there is a zone table for that netwk:
192.99.243.65.in-addr.arpa
primary name server = auth51.ns.uu.net
responsible mail addr = hostmaster.uu.net
serial = 3
refresh = 21600 (6 hours)
retry = 3600 (1 hour)
expire = 1728000 (20 days)
default TTL = 21600 (6 hours)
*** No address (A) records available for 65.243.99.192
Looks pretty clear cut and dry to me.
If your still getting messages from that netwk,
send my letter and cc abuse@uunet.net
If you need further guidance off-line, shoot me a TR query.
I hate stupidity
This discussion is closed to new replies.
Sort by Trending